Certifying PDF documents

A certifying signature (also called an author or DocMDP signature) does more than prove who signed a document — it declares which changes are permitted afterward. Any change beyond what the certification permits invalidates the signature, so PDF viewers can warn the reader that the document was altered. A certifying signature must be the first signature applied to a document, and a document can have only one.

Common use cases include:

• Locking a finalized contract so no further changes are permitted
• Publishing a form that recipients may fill in but not otherwise modify
• Certifying a report while still permitting reviewers to add annotations

How Nutrient helps

Nutrient Python SDK applies the DocMDP certification transform behind a single property. The SDK handles:

• Writing the DocMDP transform parameters that declare the permitted changes
• Marking the signature as a certifying signature in the document catalog
• Computing the byte ranges and building the CMS/PKCS#7 signature container
• Writing the signature into the PDF using an incremental update

Certification levels

The SignatureCertificationLevel enumeration declares which changes are permitted after certification:

• NOT_CERTIFIED — an ordinary approval signature, not a certifying one. This is the default.
• NO_CHANGES — no changes are permitted; any change invalidates the signature.
• FORM_FILLING — only form fill-in and signing are permitted.
• FORM_FILLING_AND_ANNOTATIONS — form fill-in, signing, and annotation changes are permitted.

Complete implementation

This example applies a certifying signature that permits form fill-in and signing:

from nutrient_sdk import Document, Signature
from nutrient_sdk import DigitalSignatureOptions
from nutrient_sdk import SignatureCertificationLevel

Certifying the document

Set the certification property to make the signature a certifying signature.

In this sample:

• Document.open("input.pdf") opens the PDF before signing.
• certification = SignatureCertificationLevel.FORM_FILLING permits form fill-in and signing after certification.
• sign(document, output_path, options) applies the certifying signature.

Because a certifying signature must be the first signature on the document, apply it before any approval signatures:

with Signature() as signer, Document.open("input.pdf") as document:
    options = DigitalSignatureOptions()
    options.certificate_path = "certificate.pfx"
    options.certificate_password = "Nutrient answers all your document needs"
    options.signer_name = "Document Author"
    options.reason = "Certifying document integrity"
    options.certification = SignatureCertificationLevel.FORM_FILLING

    signer.sign(document, "output_certified.pdf", options)

Conclusion

Use this workflow to certify a document:

1. Open the document using a context manager(opens in a new tab) for automatic resource cleanup.
2. Configure DigitalSignatureOptions with certificate credentials and signing metadata.
3. Declare the permitted changes with the certification property and the SignatureCertificationLevel enumeration.
4. Apply the certifying signature first — it must be the first signature on the document, and a document can have only one.
5. Use NO_CHANGES to lock the document completely, or FORM_FILLING and FORM_FILLING_AND_ANNOTATIONS to permit specific downstream changes.
6. Leave the default NOT_CERTIFIED for ordinary approval signatures that don’t restrict later changes.

For related signing workflows, refer to the Python SDK guides.